Implement NetKingdom identity shell for coulomb.social (CSOC-WP-0002)

Django scaffold aligned with the business delivery lane: tenant-keyed
Member model without passwords, identity app as sole OIDC/session
boundary, dev-claims login, authenticated /app/ shell, ADR-0001, and
tests. T01/T02/T05/T06 done; OIDC registration, real user-engine HTTP,
flex-auth, and packaging remain open.

docs/identity/user-engine-binding.md

@@ -0,0 +1,23 @@
+# user-engine application binding
+
+| Field | Value |
+|-------|--------|
+| application id | `coulomb-social` (`USER_ENGINE_APPLICATION_ID`) |
+| display name | coulomb.social |
+| tenant (v1) | `binky` (client #1) |
+| identity link | `(issuer, sub)` → `user_engine_user_id` on first login |
+| local row | `members.Member` (no passwords) |
+
+## Runtime
+
+| Mode | Behavior |
+|------|----------|
+| `USER_ENGINE_BASE_URL` empty | `StubUserEngineClient` — deterministic user id from issuer+sub hash |
+| URL set | `HttpUserEngineClient` placeholder (T04: wire real link/projection API) |
+
+## Profile attributes (shell only)
+
+- display name (from OIDC `name` / `preferred_username`)
+- email (optional)
+
+Bubble content fields are **not** part of this binding.